CVE-2026-43908

{
  "id": "CVE-2026-43908",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T20:17:06.920",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, producing an out-of-bounds write that crashes the process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0."
    },
    {
      "lang": "es",
      "value": "OpenImageIO es un conjunto de herramientas para leer, escribir y manipular archivos de imagen de cualquier formato de archivo de imagen relevante para VFX / animación. Antes de 3.0.18.0 y 3.1.13.0, un desbordamiento de entero de 32 bits con signo en la expresión de índice del bucle de píxeles i * 3 dentro de ConvertCbYCrYToRGB() hace que la función calcule un gran desplazamiento de puntero negativo en el búfer de salida, produciendo una escritura fuera de límites que bloquea el proceso. Esta vulnerabilidad está corregida en 3.0.18.0 y 3.1.13.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "AcademySoftwareFoundation",
          "product": "OpenImageIO",
          "versions": [
            {
              "version": "< 3.0.18.0",
              "status": "affected"
            },
            {
              "version": ">= 3.1.4.0-beta, < 3.1.13.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T14:13:22.550087Z",
          "id": "CVE-2026-43908",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.0.18.0",
              "matchCriteriaId": "90B206C1-E7DB-4175-8077-C76D5C8533AF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.1.4.0",
              "versionEndExcluding": "3.1.13.0",
              "matchCriteriaId": "34BBB27F-256F-4D15-A394-158343CB8B4D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openimageio:openimageio:3.2.0.0:dev:*:*:*:*:*:*",
              "matchCriteriaId": "F43FE0AC-4CFC-485D-8370-37336EB2CEA0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openimageio:openimageio:3.2.0.2:dev:*:*:*:*:*:*",
              "matchCriteriaId": "450296D8-74F5-4847-8433-FE3DFB16C58E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}